AI 中文总结
本研究提出嵌入用户工作流的场景化网络安全培训范式TrainShield，结合实时风险检测与LLM生成内容，初步验证其可提升风险意识，为行为导向网络安全教育提供新方向。
AI 中文摘要
近年来，网络安全威胁愈发倾向于利用人类行为而非单纯的技术漏洞，暴露了脱离真实场景开展的传统安全意识培训项目的局限性。为填补这一缺口，我们提出TrainShield，一种面向场景化网络安全培训的交互范式，它将自适应学习干预直接嵌入用户工作流中。该系统整合了实时风险检测（如钓鱼攻击与数据丢失防护）与事件触发的超媒体叠加层，后者可动态连接用户至嵌入其浏览工作流中的场景化学习节点，以提供适配用户知识水平与当前场景的个性化微学习内容及结构化反馈。该方法通过将安全事件转化为即时学习机会，践行了行为理论，推动用户在关键决策时刻从自动反应转向反思性决策。我们进一步形式化了一种设计模型，将检测到的事件映射至自适应训练实例，该模型结合了用户建模、场景提取以及基于大语言模型（LLM）的内容生成。一项初步研究表明，该方法被认为有助于提升风险意识，且相比冗长的异步传统培训格式更受青睐，同时也凸显了生成内容与用户期望对齐方面的挑战。总体而言，研究结果表明，将场景化、事件驱动的培训嵌入日常交互中，是面向行为的网络安全教育的一个有前景的方向。
英文摘要
In recent years, cybersecurity threats have increasingly exploited human behaviour rather than purely technical vulnerabilities, exposing the limits of traditional awareness programmes delivered outside real-world contexts. To bridge this gap, we introduce TrainShield, an interaction paradigm for contextual cybersecurity training that embeds adaptive learning interventions directly within user workflows. The system integrates real-time risk detection (e.g., phishing and data loss prevention) with event-triggered hypermedia overlays that dynamically connect users to context-specific learning nodes embedded within their browsing workflow to deliver personalised micro-learning content and structured feedback tailored to the user's knowledge level and current context. This approach operationalises behavioural theories by transforming security incidents into immediate learning opportunities, shifting users from automatic to reflective decision-making at critical moments. We further formalise a design model that maps detected events to adaptive training instances, combining user modelling, context extraction, and large language model (LLM)-based content generation. A preliminary study indicates that the approach is perceived as useful in increasing risk awareness and is preferred over lengthy and asynchronous traditional training formats, while also highlighting challenges in aligning generated content with user expectations. Overall, the results suggest that embedding contextual, event-driven training within everyday interactions is a promising direction for behaviour-oriented cybersecurity education.
CommentsPaper accepted for publication at ACM Hypertext 2026
